Sport Creates Memories

Privacy Policy

Effective date: 06 June 2026 · Version 2.0

This Privacy Policy describes how Sport Creates Memories ("SCM", "we", "us", "our") collects, uses, stores, shares, and protects personal information when you use the SCM mobile application (the "App"), the website at sportcreatesmemories.com (the "Website"), and the related backend services (collectively, the "Service").

The Service is designed for coaches, scouts, and administrators of youth football leagues. The Service necessarily processes information about minors (the players a coach registers). We treat this data with extra care — see Section 5: Children's Privacy.

By creating an account or otherwise using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1.Definitions

▸"Coach" — an adult user who manages one or more youth teams in a SCM league.

▸"Scout" — an adult user with permission to view player statistics across leagues.

▸"Player" — a child whose information is entered into the Service by their Coach. Players do not log in to the App.

▸"Child" — a Player under the age of 13 (under 16 for EU users). Special rules apply to Children's data.

▸"Personal Data" — any information relating to an identified or identifiable natural person.

▸"Service Provider" — a third party that processes data on our behalf under written contract.

2.Information We Collect

2.1 Information you provide to us

When you create an account or use the Service, we collect:

▸Identity: first name, last name, profile photo (optional).

▸Contact: email address, WhatsApp / mobile phone number.

▸Credentials: password (stored hashed using industry-standard algorithms — we never store passwords in clear text), one-time passcodes (OTPs) used during sign-up.

▸Location and club details: country, region, city, street address, club name, home-venue name, and an optional "requested league name" free-text field.

▸Team setup: the age categories (e.g. U-10, U-12) that you coach, separated by boys and girls teams.

▸User content: chat messages you send in league group chats or to SCM support, match-result submissions, goal scorers, and Player of the Match nominations.

2.2 Information collected automatically

▸Precise location (GPS): when you complete your coach profile, the App reads your device's GPS coordinates (latitude and longitude). We use this to confirm your club's position so that the system can group nearby clubs into leagues (within a 15 km radius). You can deny the runtime location permission; in that case, no GPS data is collected and you will be asked to type your address manually.

▸Device identifiers: a Firebase Cloud Messaging (FCM) registration token so we can send you in-app push notifications about your matches.

▸Technical logs: IP address, request timestamps, HTTP user-agent, and error logs — retained for 90 days for security and debugging purposes.

▸App usage telemetry: we do not integrate any third-party advertising SDK, analytics SDK, or cross-site tracker. We do not maintain a behavioural advertising profile of any user.

2.3 Information about Children (player profiles)

Coaches register the players on their team. For each player, the App stores ONLY the following four fields:

▸Name (first name, last name)

▸Playing position (e.g. Centre Back, Goalkeeper)

▸Date of birth

▸Photo (optional)

The Service does not collect any other category of personal data about players — no contact details, no health data, no school, no home address, no parent contacts. Players themselves do not have a login and never interact directly with the Service.

3.How We Use Your Information

▸To create and maintain your account.

▸To group nearby clubs into a league using the 15 km radius rule (uses your stored GPS coordinates or address).

▸To generate the season's fixture schedule (double round-robin) and to show each coach only the matches their team plays in.

▸To deliver in-app messaging (league group chat, SCM Contact support).

▸To send transactional push notifications (e.g. "you have a match tomorrow", "result submission received", "approved").

▸To send transactional emails (e.g. account approval, password reset).

▸To record match results, goal scorers, and Player-of-the-Match nominations so that league standings and statistics can be calculated.

▸To detect, prevent, and respond to abuse, fraud, or security incidents.

▸To comply with applicable laws and respond to lawful requests from public authorities.

We do not use your data to serve targeted advertisements, to build a profile for sale, or to train any general machine-learning model.

4.Legal Basis for Processing (EU / UK Users)

If you are in the European Economic Area or the United Kingdom, our lawful bases for processing your Personal Data are:

▸Performance of a contract — to deliver the Service after you sign up.

▸Legitimate interests — to keep the Service secure, prevent fraud, and improve features. We balance these interests against your privacy rights.

▸Consent — for optional features such as access to your device's GPS or push notifications. You can withdraw consent at any time through your device settings.

▸Legal obligation — to comply with law-enforcement requests, tax law, accounting rules, and similar.

5.Children's Privacy — Players Aged 6 to 18

SCM does not allow children to create accounts. A child appears on the platform only as a Player record entered by their Coach. The Coach acts on behalf of the parent/guardian and is responsible for obtaining any consent required by local law before uploading a child's information to the Service.

▸We collect only the four data points listed in Section 2.3.

▸We do not deliver targeted advertising. We do not embed any third-party advertising SDK in the App.

▸We do not knowingly share children's data with any party other than the Service Providers listed in Section 7 and the Scouts who are granted statistical access (see Section 6).

▸If a parent or guardian believes a player's data has been entered without authorisation, please email privacy@sportcreatesmemories.com and we will remove the player record within 30 days.

▸We comply with the United States Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (Article 8, GDPR-K), and Apple's App Store Family policy.

6.Player Statistics and Scout Visibility

Match results, goals scored, and Player of the Match nominations are aggregated against each player record to produce season-level statistics.

▸Player of the Match tallies are visible only to authorised Scouts. They are NOT visible to the player, to the player's coach, to other coaches, or to the general public.

▸Goal scorer counts are visible to the player's own coach and to authorised Scouts.

▸League standings (per-team points, wins, losses, goals for / against) are visible to all members of that league and on the public scoreboard. Standings show team names only, never individual player identities.

7.How We Share Your Information

We share Personal Data only in the limited circumstances described here. We do not sell Personal Data.

7.1 With other users on the Service

▸Other coaches in your league can see your team name, your name as a coach, your WhatsApp number, and your team's home venue — so that match logistics can be agreed.

▸Authorised Scouts can see player profiles (the four fields in Section 2.3) and the associated statistics described in Section 6.

▸The public scoreboard shows league standings (team-level only).

7.2 With Service Providers (sub-processors)

We use the following Service Providers to operate the platform. Each is bound by written contract, processes data only on our instructions, and is listed transparently here:

Provider	Purpose	Data shared
Firebase Cloud Messaging (Google)	Delivery of push notifications	FCM registration token, notification payload (e.g. "match tomorrow")
OpenAI	Powers the SCM Contact AI chat assistant	Content of messages you send to the SCM Contact bot
Gmail SMTP (Google)	Sending transactional emails	Recipient email address + email content
DigitalOcean	Hosting of application servers and database	All Personal Data, processed only on our instructions

7.3 For legal reasons

▸We may disclose data when required by court order, subpoena, or other binding legal process; to enforce our Terms of Service; to prevent imminent harm; or to respond to a credible threat to the safety of any person.

7.4 In a business transfer

▸If SCM is involved in a merger, acquisition, or sale of assets, the surviving entity will inherit this Privacy Policy. We will notify users of any material change to data-handling practices.

8.AI-Powered Features

The Service includes a chat assistant labelled "SCM Contact". When you send a message to this assistant, the content of your message — but not your name, account ID, or any other identifier beyond what you choose to include in the message body — is transmitted to OpenAI's API to generate a response.

▸OpenAI processes these messages under its Enterprise / API data-use policy, which (as of the effective date) commits to not using API-submitted content to train its models.

▸The transmission uses HTTPS in transit.

▸You can opt out of this feature simply by not using the SCM Contact chat. All other parts of the Service work without contacting OpenAI.

▸Please do not share sensitive personal information in chat messages. Treat the SCM Contact assistant like email to a customer-support agent.

9.Data Retention

▸Account data: retained as long as your account exists. Deleted within 30 days of account deletion (see Section 14).

▸Match data: retained for the life of the league season. Anonymised statistical aggregates (e.g. "Boys U-10 average goals per match") may be retained indefinitely for product analytics; these aggregates do not identify any individual.

▸Player records: deleted when the coach removes the player, or within 30 days of the coach's account deletion.

▸Chat messages: retained for the life of the league chat. Deleted on league completion + 30 days, or earlier upon request.

▸Technical / security logs: retained for 90 days, then automatically purged.

▸Encrypted backups: retained for 30 days for disaster-recovery purposes, after which they are securely destroyed. A deletion request you make may therefore live in a backup for up to 30 additional days before it is fully purged.

10.Data Security

▸Encryption in transit: all traffic between your device and our servers uses TLS 1.2 or higher (HTTPS).

▸Encryption at rest: passwords are hashed using bcrypt before being written to the database. Authentication tokens are stored using your device's secure storage (iOS Keychain / Android Keystore where available).

▸Access control: production servers are protected by SSH key authentication and IP-restricted SSH; only authorised SCM engineers have access.

▸Role-based authorisation: the backend enforces server-side role checks on every request (coach / scout / admin) so a coach cannot read another coach's players, and a player's Player-of-the-Match data cannot be read by their own coach.

▸Vulnerability response: we accept and act on security reports sent to privacy@sportcreatesmemories.com within 5 business days.

No system is perfectly secure. While we follow industry best practices, we cannot guarantee absolute security of data transmitted over the internet.

11.Your Privacy Rights

Subject to local law, you have the right to:

▸Access — request a copy of the Personal Data we hold about you.

▸Rectify — correct inaccurate or incomplete data. Most fields can be updated directly in the App.

▸Erase — request deletion of your account and associated data (see Section 14).

▸Restrict — ask us to limit processing while you contest accuracy or object to use.

▸Object — object to processing based on our legitimate interests.

▸Portability — receive your data in a structured, machine-readable format and / or have it transmitted to another controller where technically feasible.

▸Withdraw consent — where processing is based on consent (e.g. location permission), withdraw it at any time without affecting prior processing.

▸Lodge a complaint — with your local data-protection regulator.

To exercise any of these rights, email privacy@sportcreatesmemories.com. We respond within 30 days. We may need to verify your identity before processing the request.

12.International Data Transfers

Our application servers are hosted in the European Union. When data is transferred to a Service Provider located outside the EU / EEA (for example, OpenAI, which processes data in the United States), we rely on the European Commission's Standard Contractual Clauses (SCCs) or another approved transfer mechanism.

13.Cookies and Similar Technologies (Website only)

The Website uses only a small number of strictly-necessary cookies (for authentication and session management). We do not set advertising cookies. We do not embed third-party analytics or social-media trackers. You can clear or block cookies through your browser settings; the Website will continue to function but you will need to sign in again on each visit.

The SCM mobile App does not use browser cookies. It stores authentication tokens in your device's secure storage as described in Section 10.

14.Account Deletion

You can delete your account and all associated data at any time, directly from inside the App.

How to delete your account

▸1. Open the SCM App and sign in.

▸2. Go to Profile → Coach Profile.

▸3. Tap Delete Account.

▸4. Confirm the action.

What happens next

▸Your account, your team setup, your player records, your match submissions, and your chat messages are removed from our live database within 30 days.

▸Personal Data may persist in encrypted backups for up to 30 additional days before those backups are destroyed.

▸Anonymised aggregate statistics (e.g. league-level averages that cannot identify any individual) may be retained indefinitely.

▸If you cannot reach the in-app deletion control for any reason, email privacy@sportcreatesmemories.com and we will process the deletion manually within 30 days.

15.California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

▸The right to know what categories of Personal Information we collect and the purposes for which it is used (see Sections 2 and 3).

▸The right to access the specific pieces of Personal Information we hold about you.

▸The right to delete Personal Information (see Section 14).

▸The right to correct inaccurate Personal Information.

▸The right to opt out of the "sale" or "sharing" of Personal Information. We do not sell or share Personal Information for cross-context behavioural advertising.

▸The right to limit use of sensitive Personal Information. The only category of sensitive Personal Information we collect is precise geolocation (Section 2.2), used solely to group nearby clubs into leagues.

▸The right not to be discriminated against for exercising any of the above.

To exercise any of these rights, email privacy@sportcreatesmemories.com with subject "California Privacy Request".

16.European Privacy Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland:

▸The Data Controller for your Personal Data is Sport Creates Memories.

▸Lawful bases for processing are listed in Section 4.

▸Your rights of access, rectification, erasure, restriction, portability, and objection are described in Section 11.

▸You have the right to lodge a complaint with your national supervisory authority. A list is published at the European Data Protection Board (edpb.europa.eu).

▸We have appointed a privacy contact reachable at privacy@sportcreatesmemories.com.

17.Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will (i) post the revised policy on this page with a new effective date and (ii) where the change is material, notify active account holders via in-app message or email at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

18.Contact Us

If you have any questions, requests, or complaints about this Privacy Policy, please email:

privacy@sportcreatesmemories.com

We aim to acknowledge every privacy enquiry within 5 business days.